PreEmptive Protection Tackles Top Developer Compliance Complaints

May 7, 2019 556 Views Erica Kurfis

Developers cite compliance cost, complexity, and confusion as slowing innovation and impeding competitive goals. With the latest Dotfuscator and DashO releases, PreEmptive Protection dramatically improves developer productivity, automation, and scalability.

Seattle, WA. Microsoft Build Conference, May 7, 2019 - PreEmptive announced today the immediate availability of Dotfuscator Professional 4.41 and DashO 10.0 Beta. These updates to the PreEmptive Protection suite reduce initial protection configuration effort by 90% and offer complete automation of many of the most sophisticated runtime controls entirely. In a just-completed developer survey incorporating responses from over 315 organizations, 77% reported that “confusion around regulatory requirements slows innovation” while 71% stated that “the cost and complexity of compliance” is making it harder to compete.

Development organizations must find ways to meet complex privacy and compliance requirements even as they are under increasing pressure to deliver high quality, innovative features across platforms and devices.

“These releases demonstrate PreEmptive’s commitment to deliver powerful app and data security controls without unnecessary development overhead or an army of consultants.“ – Gabriel Torok, CEO PreEmptive

Dotfuscator Professional 4.41 offers an entirely new way of configuring and integrating Dotfuscator into automated build environments - installed on-demand, activated as part of the build, and run the same way as it is in development. The result is a 90%+ reduction in time and effort required to configure and integrate Dotfuscator into your preferred pipeline. “While these tools improve any CI build, they really shine with dynamic build agents - build agents that are provisioned on-demand - like in Azure Pipelines," said Nathan Arthur, Engineering VP, PreEmptive.

Dotfuscator 4.41 includes:

A NuGet package that can be deployed into a private artifact repository (e.g. Azure Artifacts) and dynamically installed via nuget install,
Dynamic licensing via a new "Floating" license model combined with flexible Dotfuscator activation options using command line arguments, environment variables, or MSBuild properties, and
A separately-released Azure Pipelines extension.

Another major innovation, Dotfuscator Visual Studio project file integration, further reduces time away from building new features and fixing bugs and supports all project types including Xamarin and early versions of Blazor and .NET Core 3.

“Taken together, these enhancements typically reduce configuration and implementation efforts by over 90%.” – William Leach, CTO, PreEmptive

DashO 10.0 Beta is the first application hardening solution to fully leverage R8, Google’s recently introduced Android app shrinker. R8 replaces ProGuard, an earlier shrinker and obfuscator. DashO 10.0 is currently in beta and is distributed with a Go Live license.

“DashO 10.0 takes a typical migration from ProGuard from hours to just a few minutes.” William Leach, CTO, PreEmptive

In addition to obfuscation transformation algorithms, DashO Android Mode also offers:

Tamper detection and defense,
Rooted device detection and response,
Anti-debugger controls,
Emulator detection and response, and
Anti-hooking controls.

Whether mobile, desktop or cloud, PreEmptive Protection’s powerful application and data protection controls can be implemented without any dependency on third-party APIs, changes to application source code or even a connection to a network.

“PreEmptive’s post-compile injection capabilities are also ideally suited to generate auditable logs and to meet specific offline requirements from organizations like the PCI Council and general guidelines from regulations like GDPR,” concluded Sebastian Holst, CSO, PreEmptive.

Latest NIST publication reinforces Developer Obligations (and liability)

On June 11, NIST released Mitigating the Risk of Software Vulnerabilities by Adopting a Secure Software Development Framework. While a solid piece of work in its own right, this document is noteworthy because it stands as one more proof point - in an already long list of proof points, that development processes, the developers themselves, and the organizations they belong to, ALL share some degree of responsibility (liability) for:

Untrusted Environments, Valuable Apps? Put the Protection in the App.

IT environments are evolving. Disappearing are the days of in-house, fixed-endpoint, limited access server stacks — replaced instead by a combination of private and public cloud solutions, mobile applications and IoT devices.

As noted by research firm IDC, public cloud spending now outpaces all other IT infrastructure with a growth rate topping 10 percent year-over-year, while Statista reports that users downloaded more than 178 billion apps in 2017 alone — and are on track to break 250 billion over the next few years.

What does this mean for organizations? That application environments are quickly moving beyond the purview of in-house IT, exposing both apps and network services to steadily growing risk. It creates a paradox: Companies can’t deny the benefits of third-party environments and application partnerships, but also can’t ignore the threat of app and data compromise or reverse-engineering and tampering.

In a recent developer survey, Xamarin.Android developers were 50% less likely to have included rooted device detection or anti-tamper prevention as their Java Android peers were. Yet, both sets of apps are being deployed through the same marketplaces onto the same devices and are governed by the same regulations (PCI, GDPR, HIPAA to name just a few that expect these kinds of controls).

Why are more Xamarin.Android apps going unprotected?

I recently had the opportunity to sit down with Sebastian Holst, PreEmptive’s Chief Strategy Officer, to talk about his most recent trip to Capitol Hill where the topic of the day was copyright protection for small businesses – and for development shops in particular.

The life of a security architect is rarely simple. Assessing, defending and improving corporate networks requires thorough knowledge of industry best practices designed to secure critical data, combined with real-world understanding of hacker tricks and tactics meant to undermine this purpose.

As noted by the InfoSec Institute, this is an in-demand job that often comes with high expectations, odd hours and the need for constant professional evolution to stay ahead of cybercriminal threats. Complicating matters is the breakneck pace of technological advancement. The rapid rise of cloud deployments, mobile applications and IoT devices can make even best-laid security strategies seem like flies in amber — hopelessly out-of-date and effectively immobile.

Here’s a look at what’s really bugging security architects — and how they can break the mold of static security to combat emerging threats.

PreEmptive Protection Tackles Top Developer Compliance Complaints

Developers cite compliance cost, complexity, and confusion as slowing innovation and impeding competitive goals. With the latest Dotfuscator and DashO releases, PreEmptive Protection dramatically improves developer productivity, automation, and scalability.

Latest NIST publication reinforces Developer Obligations (and liability)

Put the Protection in the App

Untrusted Environments, Valuable Apps? Put the Protection in the App.

Are Xamarin.Android app users at risk?

Changes are coming for US Copyright – Should Developers Even Care?

Fly in Amber: What’s Bugging Infosec Architects?

Latest Blog Posts

Latest NIST publication reinforces Developer Obligations (and liability)

Put the Protection in the App

Are Xamarin.Android app users at risk?

Changes are coming for US Copyright – Should Developers Even Care?

Fly in Amber: What’s Bugging Infosec Architects?

Twitter